WHAT IS CLAIMED IS: 



1 1 . A method for operating a storage system configured to provide a Write 

2 Once and Read Many (WORM) function, the method comprising: 

3 receiving a first command at a storage subsystem fi*om a host; and 

4 storing at least a portion of the first command on a WORM storage device 

5 coupled to the storage subsystem, 

6 wherein the WORM storage device is used to verify the WORM fimction of 

7 the storage system. 

1 2. The method of claim 1, further comprising: 

2 receiving a second command at the storage subsystem; 

3 examining the second command using a command filter, the filter being 

4 provided with a predetermined rule for filtering selected types of commands; and 

5 storing at least a portion of the second command if the second command 

6 satisfies the predetermined rule. 

1 3. The method of claim 2, wherein the command filter is configured to 

2 filter any command that affects data stored in a storage area of the storage subsystem, 

3 wherein the second command is not stored in the WORM storage device. 

1 4. The method of claim 3, wherein the command filter is configured to 

2 filter at least commands relating to ERASE, FORMAT, and WRITE operations. 

1 5. The method of claim 3, wherein the command is a Command 

2 Descriptor Block. 

1 6. The method of claim 2, wherein the storage subsystem and the storage 

2 system are the same, the method fiirther comprising: 

3 writing a subsystem configuration file in the WORM storage device whenever 

4 a subsystem configuration setting is changed. 

1 7. The method of claim 2, wherein the storage subsystem is a disk array 

2 unit having a storage area that is defined as a WORM storage area, wherein the subsystem 

3 configuration file is used to verify that data on a given storage device have not been changed 

4 or to identify a physical address of a logical volume during auditing. 
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1 8. The method of claim 2, wherein the command fiUer is configured to 

2 filter commands directed to a predetermined storage area in the storage subsystem, the 

3 predetermined storage area being defined as a WORM storage area. 

1 9. The method of claim 1, wherein at least portions of all commands are 

2 stored in the WORM device. 

1 10. The method of claim 1, further comprising: 

2 associating a serial number to the first command; and 

3 storing the serial number in the WORM storage device. 

1 11. The method of claim 10, fiirther comprising: 

2 associating a timestamp to the first command; and 

3 storing the timestamp in the WORM storage device. 

1 12. The method of claim 10, wherein the WORM storage device includes a 

2 plurality of records representing a plurality of commands received by the storage subsystem, 

3 each of the commands being associated with a serial number, the serial numbers being used 

4 to sort the commands according to a given order prior to performing an audit of the storage 

5 subsystem. 

1 13. A method for providing a data archival fiinction, comprising: 

2 storing at least portions of commands directed to a storage subsystem in a 

3 Write Once and Read Many (WORM) storage device, the commands being of a type that 

4 affects a content of data stored in a storage area of the storage subsystem; and 

5 associating a serial number to each of the commands, the serial number being 

6 usefiil for sorting the commands in a given order, 

7 wherein the WORM storage device includes a plurality of command records, 

8 the command records including the at least portions of the commands and the serial numbers, 

9 wherein the command records are usefiil for verifying whether or not a storage 
10 subsystem has maintain a WORM integrity. 

1 14. The method of claim 13, wherein the WORM storage device is coupled 

2 to a host computer, the method further comprising: 

3 decoupling the WORM device from the host computer to perform an audit to 

4 verify the WORM integrity of the storage subsystem, 
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5 wherein the plurahty of command records are sorted prior to performing the 

6 audit using the serial numbers. 

1 15. The method of claim 13, wherein the commands directed to the storage 

2 subsystems are filtered according to a predetermined rule. 

1 16. The method of claim 15, wherein the commands are filtered by 

2 examining operation codes associated with the commands or Logical Unit Numbers 

3 associated with the commands. 

1 17. A method for auditing a storage system, comprising: 

2 sorting a plurality of records stored in a Write Once and Read Many (WORM) 

3 storage device using serial numbers associated with the records, each record including 

4 information on a command sent to a storage subsystem; 

5 examining the information on the command for one of the records to retrieve 

6 address of a storage area to which the command was directed; 

7 obtaining an entry associated with the storage area from a bitmap of a plurality 

8 of storage areas of the storage subsystem; and 

9 determining whether or not there is an indication of a WORM violation using 
10 the obtained entry. 

1 18. The method of claim 1 7, further comprising: 

2 reporting a result of the determining step to an auditor; and 

3 updating the entry of the bitmap, 

4 wherein the information on the command is the command. 

1 19. The method of claim 17, wherein the WORM storage device is 

2 received from a host computer or the storage subsystem. 

1 20. An archival system, comprising: 

2 a controller to handle data requests from a host computer, each data request 

3 including a command; 

4 a command filter to select commands that satisfy a predetermined filtering 

5 rule; 

6 a Write Once and Read Many (WORM) storage device to store at least 

7 portions of the conamands that have been selected by the command filter; and 
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8 at least one storage area that has been defined as a WORM storage area for 

9 archiving data. 

1 21 . The archival system of claim 20, wherein the archival system includes 

2 a storage subsystem and a host. 

1 22. The archival system of claim 21, wherein the WORM device is 

2 coupled to the storage subsystem. 

1 23. The archival system of claim 20, wherein the archival system is a 

2 storage subsystem. 

1 24. The archival system of claim 20, further comprising: 

2 a terminal system including a WORM device reader to read information stored 

3 in the WORM device and a command checker to examine the information read from the 

4 WORM device. 

1 25. A computer readable medium comprising a computer program for 

2 verifying an archival function, the computer program comprising: 

3 code for receiving a first command at a storage subsystem from a host; 

4 code for examining the first command using a predetermined rule; 

5 code for storing at least a portion of the first command on a WORM storage 

6 device coupled to the storage subsystem upon determining that the first command satisfies 

7 the predetermined rule; 

8 code for receiving a second command at the storage subsystem from the host; 

9 code for examining the second command using the predetermine rule; and 

10 not storing any portion of the second command upon determining that the 

1 1 second command does not satisfy the predetermined rule. 

1 26. An archival system, comprising: 

2 means for handling data requests from a host computer, each data request 

3 including a command; 

4 means for filtering commands using a predetermine filtering rule to obtain a 

5 selected command; 

6 means for storing the selected command to a Write Once and Read Many 

7 (WORM) storage device; and 
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8 means for associating a serial number to the selected command that is stored 

9 in the WORM storage device. 

1 27. A disk storage system, comprising: 

2 a controller to handle data requests from a host computer, each data request 

3 including a command; 

4 a command filter to select commands that satisfy a predetermined filtering 

5 rule; and 

6 a Write Once and Read Many (WORM) device writer operable to store at least 

7 a portion of the commands that have been selected by the command filter to a WORM 

8 storage device. 

1 28. The system of claim 27, wherein the commands are used to verify a 

2 WORM integrity of the WORM storage device. 

1 29. The system of claim 27, wherein the commands are used to identify a 

2 physical address of a logical volume. 

1 30. The system of claim 27, wherein a physical address associated with a 

2 logical volume is identified by using a configuration table. 

1 31. The system of claim 27, wherein subsystem configuration commands 

2 saved in the WORM storage device are examined to validate a WORM integrity of the 

3 system. 
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